Microsoft Edge Navigation Handling Universal Cross-Site Scripting Vulnerability

Successful exploitation allows execution of attacker-controlled script in the security context of another origin within the browser. This can enable spoofing, theft or manipulation of web-session data accessible to the affected origin, unauthorized actions performed as the victim within web applications, and follow-on browser-based compromise scenarios. The published scoring indicates low-to-moderate confidentiality, integrity, and availability impact rather than native code execution on the host.

Until patching is complete, reduce exposure by limiting user access to untrusted websites and files, enforcing browser update compliance, and using web and email filtering to reduce delivery of malicious pages or documents. Because exploitation requires user interaction, user-awareness controls and restriction of opening untrusted content can lower risk, but these measures do not replace patching.

Apply the Microsoft Edge security update released by Microsoft for CVE-2026-45494. Upgrade affected Edge installations to the vendor-fixed build referenced in Microsoft’s security guidance and ensure normal browser update channels are functioning so the corrected navigation-handling logic is deployed.